DCSync Attack - Unauthorized DS-Replication-Get-Changes Requests
Detects access to sensitive Active Directory objects, such as the Domain Admins group or other privileged accounts, as identified by specific GUIDs in Windows Event ID 4662. This event is generated when an object in Active Directory is accessed, and monitoring these specific GUIDs can indicate an adversary attempting to perform reconnaissance or modify sensitive directory objects.
CQL
